With TruSTAR’s capabilities added to the Splunk Data-to-Everything Platform, customers will be able to autonomously and seamlessly enrich their detection and response workflows with normalized intelligence from third party threat intelligence sources as well as from their internal, historical intelligence sources.

Authenticating

Splunk Observability Cloud uses API Key based auth, a developer-friendly delegated access protocol. Quolum has already connected the necessary wires with Splunk Observability Cloud. Using a sequence of click-throughs, your organization's administrator allows Quolum to make API calls to Splunk Observability Cloud without getting access to passwords.

Step 1: Initiate a connection to Readme

Click the Connect button from the Connections card. If you are not an admin, you can invite your organization's Splunk Observability Cloud admin to make a connection to your Splunk Observability Cloud organization account. When you click on the Connect button, the web browser will navigate to the Splunk Observability Cloud login page.

Step 2: Log in to Splunk Observability Cloud

Log in to Splunk Observability Cloud using your organization's credentials. The exact login mechanism may depend on your Splunk Observability Cloud plan, and the sign-in mechanism used. You may have corporate SSO such as Azure AD, GSuite, or Okta along with multi-factor authentication. Once you have successfully logged-in you can find the API Key and API Secret as mentioned below in Step 3.

Step 3: Back to Quolum

Once you have granted access to Quolum, Splunk Observability Cloud is going to send you back to Quolum's page in Step 1, where you started. The Connect button on the Connections card would now say Reconnect. Reconnect is used to reauthenticate under circumstances where the access has expired.

Under the hood

Using the OAuth protocol, Quolum now has delegated access to your Splunk Observability Cloud Workspace. The Quolum server, running on Amazon AWS VPC, will be able to make API calls and retrieve feature-level utilization. Later, this data is crunched and available for visualization on the Quolum dashboard.